EUVD-2026-59555
GHSA-6hv7-5h9p-9jrw
Severity by source
AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Adjacent vector confirmed by wireless hardware attack surface; PR:N because no authentication to the victim system is required; C/I/A:H reflect kernel OOB memory corruption potential.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
wifi: ath9k: fix OOB access from firmware tx status queue ID
ath_tx_edma_tasklet() accesses sc->tx.txq[ts.qid] where ts.qid is a 4-bit hardware field (0-15), but the txq array only has ATH9K_NUM_TX_QUEUES (10) entries. A qid >= 10 causes an OOB array access.
Add a bounds check on ts.qid before using it as an array index.
AnalysisAI
Out-of-bounds array access in the Linux kernel's ath9k WiFi driver allows an adjacent network attacker to trigger kernel memory corruption via a maliciously crafted firmware transmit status queue ID. The ath_tx_edma_tasklet() function blindly indexes sc->tx.txq[] using a 4-bit hardware field (range 0-15) against an array of only 10 entries (ATH9K_NUM_TX_QUEUES), meaning any qid value of 10 or greater causes an OOB memory access with potential for high confidentiality, integrity, and availability impact. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the target system to be running a vulnerable Linux kernel version with the ath9k module loaded and active on Atheros 802.11n hardware (AR5008, AR9001, AR9002, AR9003, or compatible chipsets). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 8.8 score (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) accurately reflects the adjacent-network attack surface: an adversary controlling a rogue access point or malicious 802.11 peer could induce the target's ath9k hardware to report a queue ID outside valid bounds, causing OOB kernel memory access. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker operating a rogue wireless access point or 802.11 peer within range of a vulnerable Linux host equipped with an Atheros ath9k NIC sends crafted 802.11 frames designed to elicit a firmware tx status response reporting a queue ID of 10 or higher. When the ath9k driver's EDMA tasklet processes this status, it performs an out-of-bounds read or write on the txq array in kernel memory, potentially corrupting adjacent kernel data structures. … |
| Remediation | The primary fix is to upgrade the Linux kernel to a patched stable release: 5.10.261, 5.15.212, 6.1.178, 6.6.145, 6.12.97, 6.18.40, 7.1.5, or 7.2-rc1. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all systems using the ath9k driver (common on Linux distributions with Atheros WiFi adapters), prioritize critical and user-facing systems, and implement wireless access restrictions where feasible. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today